PT-2026-30972 · Orangehrm · Orangehrm

Rvizx · CVE-2026-39349 · Published 2026-04-07 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.8

Description OrangeHRM Open Source encrypts sensitive fields using AES in ECB mode. This encryption method preserves plaintext patterns in the ciphertext, potentially allowing disclosure of stored data.

Recommendations Update to version 5.8.1 or later.

Exploit

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2026-39349

GHSA-G29M-3JGJ-GPRG

Affected Products

Orangehrm

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39349.json · Exploit
• https://github.com/orangehrm/orangehrm/security/advisories/GHSA-g29m-3jgj-gprg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39349 · Security Note
• https://osv.dev/vulnerability/CVE-2026-39349 · Vendor Advisory
• https://twitter.com/CVEnew/status/2041603159592726710 · Twitter Post